In recent work [1]} proposed to audit the privacy guarantees of DP-SGD by instantiating a relatively weak, black-box adversary who observed the model's predictions. In this paper, we instantiate this adversary with a spectrum of attacks that spans from a black-box adversary (that is only able to observe the model's predictions) to a worst-case yet often unrealistic adversary (with the ability to poison training
gradients and observe intermediate model updates during training). This not only enables us to provide a stronger lower bounds on the privacy leakage (compared to [1]}), it also helps us identify which capabilities are needed for adversaries to be able to extract exactly as much private information as is possible given the upper bound provided by the DP analysis.
